10 ms·

FBI pushing for surveillance backdoors on websites

301 points by quadrahelix 14y ago

wmeredith 14y ago
"In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities, CNET has learned." That's a feature not a bug.
cnbeuiwx 14y ago
Hmm. Isnt the world aware that these sites already provide the government with all the info they could possibly want? You cant get privacy if you use any american company. This should be well known by now. Just for reference, here is a nice list of 800+ massive companies who support CISPA: http://www.digitaltrends.com/web/cispa-supporters-list-800-companies-that-could-help-uncle-sam-snag-your-data/ http://www.digitaltrends.com/web/cispa-supporters-list-800-c... We are experiencing the last days of freedom on the Internet. Our generation is the last one. Enjoy while it lasts.
- zacharypinter 14y ago
  I share your concerns, though I don't necessarily agree that it's the last days of freedom on the internet. With peer to peer and encryption any number of secure platforms can and have been built that are impossible for third parties to spy on. However, just because we can build these, doesn't mean they'll get the critical mass required for use. People will still gravitate towards the cool/popular/easy-to-use systems like Facebook, GTalk, Google Hangouts, Skype, etc. Those systems will be increasingly subject to eavesdropping and a general lack of privacy. The irony is that even if this bill went through and got every major internet company to provide backdoors for wiretapping, they'd only be catching the low hanging fruit.
  - cnbeuiwx 14y ago
    I think you and me and other people into computers will always find ways to avoid big brother. But if 99% of the population is being watched (since the majority will gladly give up privacy for convenience), its not a very free internet anymore. Yes, government acts such as these would be ironic IF they were about fighting "terrorism" (lol). But thats just their excuse.
    - Monotoko 14y ago
      Before '95 I'm sure anyone you asked, who was online, could tell you about basic HTML, circumventing blocks, security and even some basic CS knowledge. These days, everybody is online, mainly for easy to use services like Facebook, they don't give a crap how it works. The 99%, are the 99% who were not online twenty years ago, the 1% are the people who were (or would have been) online 20 years ago.
    - enqk 14y ago
      Which leads me to wonder, why do they need surveillance of the common man. The government does not trust its citizen. Is it because it knows it has turned its citizenry into something that can be manipulated?
      - cnbeuiwx 14y ago
        There are many theories. But lets look at what they are doing: - They dont care about their spending (US national debt is insane). - They dont put any money in improving the country (almost everything goes to the war machine). Only a country who knows none of this is going to matter in the future would do this since its suicidal, obviously. So why is it not going to matter? I dont think we want to know... but the survellience is there for them to feel safe against us when it happens.
rdtsc 14y ago
> If you create a service, product, or app that allows a user to communicate, you get the PRIVILEGE of adding that extra coding," a person who has reviewed the FBI's draft legislation told CNET. Wait how is that a "privilege". Are they kidding? Is that supposed to be funny? How is adding wiretapping features to invade my users' privacy a privilege. It is like saying if you do something we don't like you get the privilege to get punched in the face.
- deleted 14y ago
  [deleted]
- alttab 14y ago
  Not to mention it forces additional strains on technology start-ups that now have regulation over-head cost from Feds that are mad they can't violate the 4th amendment where ever they want.
- to3m 14y ago
  I assume it is dry humour. But perhaps they meant, "reward". After all, it won't happen if you aren't successful. It is like paying tax in that respect.
  - citricsquid 14y ago
    I assumed it's a patriotic thing, "you get to help protect Americans citizens" type deal.
    - cantankerous 14y ago
      It'd definitely dry humor, as it was in the context of a conversation with an industry rep who presumably wouldn't be interested in making more work for his constituents.
- joe_the_user 14y ago
  I assume it is humor. But the implementation of this still "raises massive questions". Anyone who creates a communication mechanism now has a legal obligation to create a feature allowing the state to listen? Today, you can create a communication mechanism and you don't have an obligation to make it work reliably if your users don't care. But your obligation to the state suddenly becomes the creation of an effective surveillance mechanism. That could easily cost more than the rest of the system. I mean, would "Chat Roulette" suddenly have to be able to stream everything to FBI headquarters? This absurdity has been gone over many here of course but its still awe-inspiring...
generateui 14y ago
This is potentially very destructive to Silicon Valley.
jcoder 14y ago
> The requirements apply only if a threshold of a certain number of users is exceeded They're not even pretending that this is really about catching savvy criminals, and not mass-surveillance.
- molesy 14y ago
  The FBI wants to catch "criminals", and they like easy backdoors. The NSA is the one interested in mass-surveilance and they usually are very good at collecting information with little to no help from corporations, seeking more direct interaction only when the scale of a particular target (say Facebook) becomes so large that they need to move their filters closer to the real data to keep up. Usually these things start pretty innocently - you'll be approached by a local police department who has a real murderer they're trying to catch, who happens to be stalking people on your service. I've been through and heard of that kind of approach happening several times. Everyone knows the big NSA/MegaFed style visits happen as well, usually not before your CEO is hobnobbing with Senators anyways, giving keynote speeches to large globalist audiences, etc. (IE by the time they let you know, you're already part of the system anyways.) That's theory, I've only experienced the former not the latter. Some day hopefully! (edit: I've witnessed the FBI backdoor, not the NSA. :P)
igorsyl 14y ago
I hope this spurs the massive adoption of client-side encryption. Server-side encryption has proved to be just a marketing tool.
- tarr11 14y ago
  I think the real problem is that almost all applications default to cloud storage of data. They are not going to accept data that is unintelligible to them (certainly not for free). If developers would start to make their apps "cloud optional", then you could at least choose how your data is shared.
  - cnbeuiwx 14y ago
    You wont see that from massive American companies (except possibly Mozilla who always have had strong interests in consumer privacy and integrity). But there is still alternatives out there. You just have to give up the sites and corporations you have gotten used to over the years. Google, Facebook, Microsoft... Also, if you use Windows, you can pretty much count on it having backdoors already. Thats just my opinion based on common sense. The largest american operating system being free from backdoors? Heh, not very likely. THe NSA could pretty much force them to put it in, and put a gag order on them afterwards. Thats the reality of United States.
  - jonknee 14y ago
    > They are not going to accept data that is unintelligible to them (certainly not for free). Why not? You can store two gigabytes of random noise with Dropbox for free. 5GB worth on Google Drive. Storage locker services don't care if files are encrypted either. I actually can't think of a service that does care.
- drivebyacct2 14y ago
  I hope for a lot of things too. But we've known that the NSA is whole-scale wiretapping the Internet for years and no one cares enough to fix the problem.
- brigade 14y ago
  Few mainstream services are going to accept data they can't recover for a user when they forget their password and their computer failed. Which pretty much precludes client-side encryption.
jasonjackson 14y ago
I can't imagine how this ability would combat terrorism. It's trivially easy to write your own communication software -- why would anyone doing serious crime use Skype? On the other hand, now the government gains widespread power over the vast majority of innocent citizens. However, it's also worth noting that this request is merely reinstating wire tapping abilities that the government once had over communication before the rise of the internet.
- cnbeuiwx 14y ago
  Does anybody even still believe this is about fighting "terrorism"? Its been quite a ridicolous claim ever since 9/11 and its been a decade now. I dont mean to put you or anyone else down, because I know there is an absolutely massive media campaign 24/7 on all news stations, making people feel threatened and insecure. But its time to realize whats going on. At least so you can tell your children what storytelling the government used to destroy the spirit of the Internet. Just in case the history books goes with the public propaganda, and they probably will.
- bdunbar 14y ago
  why would anyone doing serious crime use Skype? I don't agree with this at all but ... I'd venture that most criminals are not exactly tech savvy. We've all seen those stories about guys caught because they posted pictures of their deeds on Facebook or Myspace.
  - pdubs 14y ago
    >I'd venture that most criminals are not exactly tech savvy Even if this is currently true; it will change.
    - deleted 14y ago
      [deleted]
    - thematt 14y ago
      Will it? Criminals know they can be wiretapped, but that hasn't stopped them from using phones for communicating.
bgentry 14y ago
In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities I call that progress.
- nextparadigms 14y ago
  Indeed. That comes from the same FBI who said a couple of months ago that having to get warrants makes their job harder.
  - lkrubner 14y ago
    Indeed. Having to respect any civil rights protections (the need for a warrant, habeas corpus, the right to silence, the right to avoid self-incrimination, the ban on torture, etc) makes life more difficulty for the authorities. But history shows that those societies that have no civil rights protections are not happy or prosperous over the long term, and a government that rids itself of all checks and balances is a government that must necessarily be authoritarian and unaccountable.
- howeyc 14y ago
  This is exactly what I don't understand every time they try to pass a law like this, it's always "It's getting harder for us to catch criminals doing X," where X changes depending how hard they think they have to force it. My response is always, NOBODY said law enforcement SHOULD BE EASY, deal with it.
  - cnbeuiwx 14y ago
    You have to give them some credit though because its a clever scheme. The "fight crime" argument is always valid since crime always exists. Its the same with "fight terrorism" since terrorism always exists. So if you use those arguments, in combination with a war that has no end (you cant win against a "ism"), you dont even have to talk to the public anymore and justify anything. Its very convenient and saves time. Note the sarcasm. :)
rodly 14y ago
If this gets any traction we will at least benefit in 100% knowing our (American) government is a joke. The FBI has a "going dark" problem? Really!? How is that possible exactly? Criminals aren't using Facebook and Skype to discuss their activities. Even if they were, I'm sure Facebook and Skype have some automated flagging system for keywords that come up in any communication channel they operate. Nonetheless, aside from cyber criminals, "hackers", traditional criminal behavior is executed in real life. The same reality that the FBI has sufficient surveillance on 24/7.
- drivingmenuts 14y ago
  We might understand the joke, but we're only an insignificant part of the voting population. The vast majority of American voters don't understand that their ability to sleep at night free of terror comes at the chipping away of their freedoms elsewhere. They don't make the connection between feeling up someone else's kids in an airport and the loss of freedoms in general. The things we talk about (encryption, backdoors, etc.) seem trivial to us because we're buried in it every day or at least have some context to place it in. But Joe the Plumber or Betty the Housewife doesn't. They don't even really have a place to start to get simple, concise information on how to start understanding it in a way that fits in with their daily lives. It's not that they can't learn - they don't have the resources or the time.
forgottenpaswrd 14y ago
I do not use facebook, but... ...If they pass this law I am also quiting from gmail. We need a freedom box that we control and is distributed, not centralized so automation of surveillance is harder. I know that there are bad guys out there, but not only in terrorist organization, secret service use to have garbage people too (the people that love power too much).
- ajross 14y ago
  I don't think Google delivers over TLS (it doesn't to my server anyway), so in general your mail is subject to wiretapping anyway. And even if it did there's no way protocol I know (maybe DKIM has a section for destination verification?) for them to know that they're really delivering it to the right host. Basically unencrypted email is a lost cause already. If you care about this stuff you need to dump webmail right now and go with a client encryption solution (and convince all your friends to use it).
  - sp332 14y ago
    Gmail is https by default.
    - ajross 14y ago
      That's between your browser and their server. I'm referring to the content of the SMTP connection over which the mail travels, which remains almost always unencrypted in the modern world. Which essentially means that the FBI doesn't need Google's assistance to wiretap your email per se, they just use and machine they probably have sitting on the backbone pipe anyway.
      - sp332 14y ago
        POP, IMAP, and SMTP access to Gmail servers all require TLS. https://support.google.com/mail/bin/answer.py?hl=en&answer=78799 https://support.google.com/mail/bin/answer.py?hl=en&answ... and https://support.google.com/mail/bin/answer.py?hl=en&answer=13287 https://support.google.com/mail/bin/answer.py?hl=en&answ... Edit: oh you mean from e.g. comcast.com server to mail.google.com server. Never mind.
agwa 14y ago
In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities It is not at all a given that this "going dark problem" actually exists. In many ways, surveillance is easier than it has ever been. See https://www.cdt.org/blogs/2811going-dark-versus-golden-age-surveillance https://www.cdt.org/blogs/2811going-dark-versus-golden-age-s...
abruzzi 14y ago
This would seem to be an opportunity for CS people to do what the do best--obfuscate through bad UI design. If they're legally obligated to provide an interface, then why make it a good interface? I'm thinking that the FBI's interface to the snooping back door should be through a pseudo-lisp interpreter with vividly named functions: (violateRights (shackle (humiliate userID))) Or similar.
- moron 14y ago
  Yeah, or maybe the backdoor "accidentally" has a lot of null-reference bugs and other crappiness. It isn't adding business value in the first place, why try to make it any good.
- simonbrown 14y ago
  Or a Malbolge API.
- malandrew 14y ago
  Alternatively, there is no reason such a backdoor can't be programmed to inform the user. "Usage of this backdoor will inform the user that they are being surveilled" I don't think you can execute a National Security Letter gag order against source code.
  - corin_ 14y ago
    Obviously the fact that it's in source code is irrelevant, otherwise every gag order could be got round with a quick <p>here is the information</p> page hosted on a webserver.. It's like saying you can shoot somebody because a gun can't be prosecuted for murder.
    - malandrew 14y ago
      Yeah, but when someone gets shot with a gun you can't prosecute the manufacturer, so long as they put warning labels on their guns and sell them according to the laws regulating the sale of guns. The person responsible is the person who pulled the trigger, which in this case would be the Feds. The key is to make sure that they get access to the backdoor directly. At the end of the day you can always code loopholes around the law, which will work until they legislate the loopholes away with more legislation. Almost every industry has been doing this since the beginning of government. One of the best ways to code this into the system is to provide security measures that allow you to prevent what machines can access your account and notify you if machines not your own try to access your account. "You recently tried to access your account from the IP address X.X.X.X located in Quantico, Virginia. If this was not you, please report this to customer service." Customer service can then legitimately comply with the gag order by admitting nothing and say they'll look into it.
hhastings 14y ago
If al-Qaeda can build their own bombs and guns, I'm pretty damn sure they can set up their own secure Email & VOIP servers.
- typicalrunt 14y ago
  Screw email and VOIP servers. In the movie Traitor, one person would compose an email and then save it to the draft folder. Then the other person would login to the same Webmail account and read the draft message. Since the message is never sent over the wire, there's no need for secure email (only SSL for the email client).
gregPC 14y ago
This just proves the world is overpopulated when we have such useless idiots as the FBI, inventing new ways to make themselves seem useful. If you are an FBI agent, quit your job, buy a dairy cow, and finally give the world something it needs.
readme 14y ago
I hope someone stands up to these bullies. They can't make us do this. Really, a few powerful people just need to say no. If you are in this position, please for the love of god don't agree to put a surveillance backdoor in your website.
- kozubik 14y ago
  Done and done: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt We've been running it for seven years now: http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-canary-in-2010-and-beyond.html http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-can...
  - cnbeuiwx 14y ago
    Very nice, but what if you get a gag order from FBI or NSA? Then you would be required to go to prison if you uphold your promises on the web site and disclose what happened. But I would be interested in your comments regarding this theoretical situation. Surely you must have thought about it.
    - kozubik 14y ago
      The gag order is the whole point. Read through it again - it is a positive, affirmative statement that we make each week (and make in three continents). A judge (or LEA, whatever) would have to compel us to make false public statements on an ongoing basis, and would have to further compel foreign (swiss) nationals to do likewise. Can we be held in contempt, etc., for refusing to make public false statements ? Perhaps. In reality, since rsync.net is not actually an ISP (we take pains to make sure we do not count as an ISP, since it allows us to skip things like the OP has posted) and since we host no publicly available materials, we're not likely to get a warrant. If we do, it's likely to be an extremely mundane act of discovery, etc. That would get added to the warrant canary and we would continue updating it. In our 11 years of running this service (7 years under the "rsync.net" brand) we've not gotten a single one. But the parent to these comments was speaking of taking a stand, which is why this was instituted - people do indeed need to make a stand. We refuse to live in a world with Lettres de Cachet, and that's that.
shareme 14y ago
here is my interface: if FBI wants to violate the constitution { here_is_your_hand_grenade make sure to pull pin before inputting your data request } else { hackers saved you thank us later }
theorique 14y ago
Do not fear, subjects. If you have done no wrong, you have nothing to worry about. Sleep safely in your beds. The government is watching over all who might do you harm.
spoiledtechie 14y ago
I don't know about anyone else here, but I am getting sick and tired of this. I personally think we as a community need to start a movement. This is ridiculous.
zupreme 14y ago
I just heard a BBC news spot where one of the interviewees, a law professor if I recall correctly, indicated that the support for CISPA by Facebook and other prominent startups was in order to provide legal cover for just these types of requests. Under current rules, it was stated, while these companies can be pressured by the FBI to release certain info and give certain access, they have no immunity from litigation - so they can still be sued for complying with the requests by their users and other concerned parties. The interviewee indicated that CISPA gives them the legal immunity they need so that they can comply with the FBI while being able to fend off potential lawsuits.
- deleted 14y ago
  [deleted]
nollidge 14y ago
"To serve and protect." Is that even true anymore? Was it ever? Was just reading about an apparent increase in cop-on-citizen sexual assault among Occupy Wall Street protesters: http://www.nakedcapitalism.com/2012/05/david-graeber-new-police-strategy-in-new-york-sexual-assault-against-peaceful-protestors.html http://www.nakedcapitalism.com/2012/05/david-graeber-new-pol... Why aren't our law enforcement professionals more accountable to us, the citizens they purportedly "serve"? The transaction ought to be that we, the citizenry, grant them privileges - go through red lights, carry firearms, right to detain people - in return for restraint and considered application of those privileges. I no longer believe in the integrity of that transaction. Maybe I'm overreacting to propaganda. But what reassurance does our law enforcement ever offer us that they are not abusing their privileges?
- cnbeuiwx 14y ago
  Why should they be accountable to you? The law enforcement gives them their salary, it protects them, it puts food on their table. What do ordinary citizens do for them, except create work for them to deal with? Edit: Just so you dont think I am nuts, I realize the insanity of the system, and I wish this was a world where intelligent, compassionate people made the decisions.
  - WiseWeasel 14y ago
    Elect their boss?
    - cnbeuiwx 14y ago
      From a pool of candidates being presented to you as choices, preselected to be there because they are all corrupt? If you add a predetermined winner, you have your presidential election system. :)
      - WiseWeasel 14y ago
        I blame old centralized media. That's changing, if more slowly than some of us might like, and disturbingly quickly for others.
DanielBMarkham 14y ago
Some days I wish I could purchase a huge lighted sign, kilometers in length, and place it on the moon. It'd say "The internet is not broken" I think I'd make it flash. That's it. It's not perfect, security is a real threat and hassle to those on it, but it's not broken. It does not need fixing by the government. I am very sorry that the FBI is unable to track communications on the net. Really I am. But this is no different than the problem they had before telephones were invented. In fact, throughout much of our nation's history, law enforcement had no idea what kind of communications criminals had. The universe did not explode. Somehow life went on. I read last week that although most recent college grads are having problems finding work, there are exceptions. One of those are, sad to say, legal professionals seeking government work. The federal government is snatching up young lawyers and even paying off all their college bills in addition to their salary. In return we're creating an army of legal attack dogs in each agency looking for new ways to "fix" things for their paymasters. Once again, it's not perfect. But it does not need fixing. What we're seeing now isn't the end of some long civil discussion about what rights everybody should have in a technological world. It's the beginning -- just the beginning -- of a new world where a lot of things we took for granted just a decade ago aren't going to be true any more.
- ArtB 14y ago
  > I am very sorry that the FBI is unable to track communications on the net. Really I am. But this is no different than the problem they had before telephones were invented. In fact, throughout much of our nation's history, law enforcement had no idea what kind of communications criminals had. The universe did not explode. Somehow life went on. A gem, so I wanted to highlight it from the rest of your post.
  - ahi 14y ago
    Pedantry: The telephone predates the FBI by about 30 years or so.
  - btilly 14y ago
    It would be a gem, were it true. Generally criminals have had the same kinds of communication as the rest of us. Before the internet, the telephone. Before the telephone the telegraph. Throughout both and before, regular mail. The FBI and preceding law enforcement forces have demanded and found ways to tap these communication mechanisms. Some private networks escaped their surveillance - such as the Rothschild carrier pigeon network - but government surveillance of private individuals is not a new problem. What is relatively new is that the mechanisms that would be used to provide it are easily exploitable by a clever person sitting in a room in China. You can't easily give the FBI tools to catch local criminals without creating exploitable security threats in our own infrastructure.
cantankerous 14y ago
Ala Field of Dreams: if you tap it, they will encrypt. Encryption was much harder to obtain on phone-like devices for 'common-folk'. On data-oriented medium, it's pretty much par for the course. Not sure how this is so readily justifiable.
kaichanvong 14y ago
It would seem they are more obsessed dealing with the symptoms of the problem than the real problem.
jpdoctor 14y ago
The FBI needs to learn: Implementing surveillance techniques like these is the best business subsidy that foreign web sites could ever dream of. What a great way to drive email servers out of their reach. Someone needs to make the FBI more supportive to US businesses.
cookiecaper 14y ago
Use encryption on ALL data that you don't want to publicly readable. I post something that says this pretty much weekly on here and I'm sure I could post it every day if I had the time. Stop trusting third parties to keep your data back; they lose it all the time, through subpoenas, leaks, accidents, exploits, whatever. Take responsibility for yourself. If you have comms that can't safely be aired on CNN, ENCRYPT THEM. There's simply nothing else to say on the matter. Don't trust anyone else to protect you, because they aren't able to even if they try. You must use real, client-side cryptography to keep your message even semi-secure.
- mvip 14y ago
  While I most certainly agree, this begs the question: what encryption tools can you use (and trust)? I'm pretty confident that there are backdoors in most commercial tools from Apple, Microsoft and PGP (just to name a few). Before anyone is too quick on say that TrueCrypt is the answer, please note that there have been wild speculations about backdoors etc in TrueCrypt too (but I don't think anything has been proven).
  - Karunamon 14y ago
    Truecrypt is OSS and has some insanely brilliant people working on it. I think that more than a couple people would notice if there were shenanigans afoot.
    - cnbeuiwx 14y ago
      Hmm. Interesting statement since the authors have chosen to remain anonymous. You would think it would be impossible to know weather or not they are brilliant, or if they are working for the US security agencies. So you have people working on the most well known full disk encryption system on planet Earth, but they are living in obscurity.... kind of interesting isnt it?
      - mvip 14y ago
        or they have chosen to stay anonymous to avoid being pressured by various governments to implement backdoors. I guess we will never know for sure.
Joss451 14y ago
Can't they just borrow it from the NSA?
novalis 14y ago
Let us all just stream, wait... triple stream everything to that new shiny spy center they built in Utah and just get over with it already. These people are simply out of control now. The fact that this is in the works just shows how unapologetic the clueless little three letters are these days. One step up from that is the analysis that these people intend to operate above the law and these "secret" understandings that they build on laws must be put to an end while the authors must be jailed for a long time.
WiseWeasel 14y ago
This is sure making offshore hosting/incorporation look pretty sweet right now. Facebook should move their headquarters to New Zealand.
albertsun 14y ago
The worst part is that laws like these add to the regulatory burden faced by small internet startups to get off the ground. The trickier the legal environment and the amount of rules that a company has to abide by to do business online, the harder it will be to do business and the fewer startups will succeed. The internet giants, Microsoft, Google, Facebook, et al. might even welcome additional rules like this. They provide additional barriers to entry and provide them more protection against new competitors. I'd reckon that it's in large part because the internet hasn't had many rules like this that the cycles of innovation online have been so fast.
- simonbrown 14y ago
  The article said there would be minimum number of users for the rules to apply.
  - albertsun 14y ago
    The effect is still there, it makes scaling up more difficult. There are possible futures where very small teams can run services for very large numbers of people.
getpost 14y ago
I don't see how this could ever work, in practice. What constitutes a sufficient surveillance capability for a webapp that is constantly evolving? With every change to your app, you have to update the surveillance aspect as well. This seems like a real burden that limits innovation. > The requirements apply only if a threshold of a certain number of users is exceeded So, you start the next Instagram with barebones resources. You don't design/build surveillance into your admin console. Your service takes off, and then you have to stop accepting users after some magic number? The government needs to get over the idea that surveilling everyone in all circumstances is the best way to promote a civil society.
nirvana 14y ago
I wonder how they are going to enforce this law on cryptographically secure communication software written by some anonymous group and released as open source software out on the net? I guess being able to pin the maintainer of the github repository to the wall might be a problem, but its easy to imagine this just forcing development underground and users upgrading only in big jumps every couple of years. Its not like this software would need to be changing all the time... people could email each other their ip addresses or the software could take care of it for them in the background. (e.g.: when its running it polls your email server to see if you've gotten an email with your friends ip address being updated, signed by his private key, then if you want to call him your client has the right email address to send the packets to directly)... negating the need for any kind of centralized server. (I'm sure there are better ways to do this.) Write a javascript version that can run in the browser and anyone with a web browser can then use it (and you can sidestep the appstore as well, because you can make downloadable installable javascript apps that show up on the home screen in this way. Apple's had that in there since before the appstore and it still works and is supported.)
- lurchpop 14y ago
  They can just make it illegal to use that software, and use a gun silencer analogy. a 75 year old judge would eat that up.
lurkinggrue 14y ago
There's something that totally won't be hacked or leaked.
bretthardin 14y ago
I think the FBI is watching the movie, "The Net" too much.
tubbo 14y ago
"If you create a service, product, or app that allows a user to communicate, you get the privilege of adding that extra coding" What kind of sick, twisted monster thinks "adding extra coding" is a GOOD THING???
zmmmmm 14y ago
"only if a threshold of a certain number of users is exceeded" And thus the stupidity and evil-ness of the whole plan is revealed. They don't want to spy on criminals, who will use the minority methods that aren't monitored. They want to spy on the general population who is innocent of any crime.
SkyMarshal 14y ago
2012 is shaping up to be a deluge of rights-curtailing legislation. Did the guys behind the curtain just decide that smart-bombing Congress with this shit doesn't work, it gives citizens enough time and leeway to resist it, so instead they're gonna try the carpet-bombing strategy instead? WTF. We shouldn't have to keep fighting these battles.
twelvechairs 14y ago
When things like this happens it makes it seem sensible that China doesn't allow US companies (facebook et al) into their market. When it comes down to an argument of who gets to spy on users - theyd rather do it themselves than allow another country to do it behind the back door. (note: I'm not saying its right that anyone should) So whats the net result? Bad for business - bad for innovation, because you are further dividing the internet (and hence the market for internet services) up on nationalistic lines.
wyck 14y ago
This is convoluted at best, the internet is not the telephone. The more they push, there more technology that uses encryption/vps/offshore/offworld/alternative routes/etc will become easier for the average user and not just the command line jockey. So what will the FBI do when sites start registering in other countries, use hosting in other countries, use alternative non U.S. DNS, open source, and encryption? ps. This is already happening on the small scale , and the losers are the job market. As a Canadian I no longer register .com names nor do I host in the U.S., and I did so for 10 years.
compilerc 14y ago
"The FBI draft also contains provisions for requiring mobile phone customers to speak clearly and slowly."
chefsurfing 14y ago
The influence of RAND Corp on this legislation is instructive. CISPA is not the creation of Hollywood or even the FBI, it's coming from people building a technocratic military-industrial complex. Interesting background interview with RAND researcher here: http://www.corbettreport.com/episode-173-alex-abella-inside-the-rand-corporation/ http://www.corbettreport.com/episode-173-alex-abella-inside-...
charlieok 14y ago
Woah, I didn't know that Joe Biden was the sponsor of the exact bill that Phil Zimmerman referenced in his essay, “Why I Wrote PGP”. From the OP: “On the other hand, as a senator in the 1990s, Vice President Joe Biden introduced a bill at the FBI's behest that echoes the bureau's proposal today. Biden's bill said companies should "ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." (Biden's legislation spurred the public release of PGP, one of the first easy-to-use encryption utilities.)” The bill: S.266 Latest Title: Comprehensive Counter-Terrorism Act of 1991 Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced 1/24/1991) Cosponsors (3) From Zimmerman's essay: “Senate Bill 266, a 1991 omnibus anticrime bill, had an unsettling measure buried in it. If this non-binding resolution had become real law, it would have forced manufacturers of secure communications equipment to insert special "trap doors" in their products, so that the government could read anyone's encrypted messages. It reads, "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." It was this bill that led me to publish PGP electronically for free that year, shortly before the measure was defeated after vigorous protest by civil libertarians and industry groups.” http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html In that case, thank you Joe Biden? :)
lukeschlather 14y ago
In related news, the FBI has banned sales of regular paper, and requires that any paper be embedded with microtransmitters that the FBI can easily activate and read the contents of the paper, effectively closing the analog gap that prevents papertapping.

301 points by quadrahelix 14y ago

"In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities, CNET has learned." That's a feature not a bug.

cnbeuiwx 14y ago

Hmm. Isnt the world aware that these sites already provide the government with all the info they could possibly want? You cant get privacy if you use any american company. This should be well known by now. Just for reference, here is a nice list of 800+ massive companies who support CISPA: http://www.digitaltrends.com/web/cispa-supporters-list-800-companies-that-could-help-uncle-sam-snag-your-data/ http://www.digitaltrends.com/web/cispa-supporters-list-800-c... We are experiencing the last days of freedom on the Internet. Our generation is the last one. Enjoy while it lasts.

zacharypinter 14y ago
I share your concerns, though I don't necessarily agree that it's the last days of freedom on the internet. With peer to peer and encryption any number of secure platforms can and have been built that are impossible for third parties to spy on. However, just because we can build these, doesn't mean they'll get the critical mass required for use. People will still gravitate towards the cool/popular/easy-to-use systems like Facebook, GTalk, Google Hangouts, Skype, etc. Those systems will be increasingly subject to eavesdropping and a general lack of privacy. The irony is that even if this bill went through and got every major internet company to provide backdoors for wiretapping, they'd only be catching the low hanging fruit.
- cnbeuiwx 14y ago
  I think you and me and other people into computers will always find ways to avoid big brother. But if 99% of the population is being watched (since the majority will gladly give up privacy for convenience), its not a very free internet anymore. Yes, government acts such as these would be ironic IF they were about fighting "terrorism" (lol). But thats just their excuse.
  - Monotoko 14y ago
    Before '95 I'm sure anyone you asked, who was online, could tell you about basic HTML, circumventing blocks, security and even some basic CS knowledge. These days, everybody is online, mainly for easy to use services like Facebook, they don't give a crap how it works. The 99%, are the 99% who were not online twenty years ago, the 1% are the people who were (or would have been) online 20 years ago.
  - enqk 14y ago
    Which leads me to wonder, why do they need surveillance of the common man. The government does not trust its citizen. Is it because it knows it has turned its citizenry into something that can be manipulated?
    - cnbeuiwx 14y ago
      There are many theories. But lets look at what they are doing: - They dont care about their spending (US national debt is insane). - They dont put any money in improving the country (almost everything goes to the war machine). Only a country who knows none of this is going to matter in the future would do this since its suicidal, obviously. So why is it not going to matter? I dont think we want to know... but the survellience is there for them to feel safe against us when it happens.

rdtsc 14y ago

> If you create a service, product, or app that allows a user to communicate, you get the PRIVILEGE of adding that extra coding," a person who has reviewed the FBI's draft legislation told CNET. Wait how is that a "privilege". Are they kidding? Is that supposed to be funny? How is adding wiretapping features to invade my users' privacy a privilege. It is like saying if you do something we don't like you get the privilege to get punched in the face.

deleted 14y ago
[deleted]
alttab 14y ago
Not to mention it forces additional strains on technology start-ups that now have regulation over-head cost from Feds that are mad they can't violate the 4th amendment where ever they want.
to3m 14y ago
I assume it is dry humour. But perhaps they meant, "reward". After all, it won't happen if you aren't successful. It is like paying tax in that respect.
- citricsquid 14y ago
  I assumed it's a patriotic thing, "you get to help protect Americans citizens" type deal.
  - cantankerous 14y ago
    It'd definitely dry humor, as it was in the context of a conversation with an industry rep who presumably wouldn't be interested in making more work for his constituents.
joe_the_user 14y ago
I assume it is humor. But the implementation of this still "raises massive questions". Anyone who creates a communication mechanism now has a legal obligation to create a feature allowing the state to listen? Today, you can create a communication mechanism and you don't have an obligation to make it work reliably if your users don't care. But your obligation to the state suddenly becomes the creation of an effective surveillance mechanism. That could easily cost more than the rest of the system. I mean, would "Chat Roulette" suddenly have to be able to stream everything to FBI headquarters? This absurdity has been gone over many here of course but its still awe-inspiring...

generateui 14y ago

This is potentially very destructive to Silicon Valley.

jcoder 14y ago

> The requirements apply only if a threshold of a certain number of users is exceeded They're not even pretending that this is really about catching savvy criminals, and not mass-surveillance.

molesy 14y ago
The FBI wants to catch "criminals", and they like easy backdoors. The NSA is the one interested in mass-surveilance and they usually are very good at collecting information with little to no help from corporations, seeking more direct interaction only when the scale of a particular target (say Facebook) becomes so large that they need to move their filters closer to the real data to keep up. Usually these things start pretty innocently - you'll be approached by a local police department who has a real murderer they're trying to catch, who happens to be stalking people on your service. I've been through and heard of that kind of approach happening several times. Everyone knows the big NSA/MegaFed style visits happen as well, usually not before your CEO is hobnobbing with Senators anyways, giving keynote speeches to large globalist audiences, etc. (IE by the time they let you know, you're already part of the system anyways.) That's theory, I've only experienced the former not the latter. Some day hopefully! (edit: I've witnessed the FBI backdoor, not the NSA. :P)

igorsyl 14y ago

I hope this spurs the massive adoption of client-side encryption. Server-side encryption has proved to be just a marketing tool.

tarr11 14y ago
I think the real problem is that almost all applications default to cloud storage of data. They are not going to accept data that is unintelligible to them (certainly not for free). If developers would start to make their apps "cloud optional", then you could at least choose how your data is shared.
- cnbeuiwx 14y ago
  You wont see that from massive American companies (except possibly Mozilla who always have had strong interests in consumer privacy and integrity). But there is still alternatives out there. You just have to give up the sites and corporations you have gotten used to over the years. Google, Facebook, Microsoft... Also, if you use Windows, you can pretty much count on it having backdoors already. Thats just my opinion based on common sense. The largest american operating system being free from backdoors? Heh, not very likely. THe NSA could pretty much force them to put it in, and put a gag order on them afterwards. Thats the reality of United States.
- jonknee 14y ago
  > They are not going to accept data that is unintelligible to them (certainly not for free). Why not? You can store two gigabytes of random noise with Dropbox for free. 5GB worth on Google Drive. Storage locker services don't care if files are encrypted either. I actually can't think of a service that does care.
drivebyacct2 14y ago
I hope for a lot of things too. But we've known that the NSA is whole-scale wiretapping the Internet for years and no one cares enough to fix the problem.
brigade 14y ago
Few mainstream services are going to accept data they can't recover for a user when they forget their password and their computer failed. Which pretty much precludes client-side encryption.

jasonjackson 14y ago

I can't imagine how this ability would combat terrorism. It's trivially easy to write your own communication software -- why would anyone doing serious crime use Skype? On the other hand, now the government gains widespread power over the vast majority of innocent citizens. However, it's also worth noting that this request is merely reinstating wire tapping abilities that the government once had over communication before the rise of the internet.

cnbeuiwx 14y ago
Does anybody even still believe this is about fighting "terrorism"? Its been quite a ridicolous claim ever since 9/11 and its been a decade now. I dont mean to put you or anyone else down, because I know there is an absolutely massive media campaign 24/7 on all news stations, making people feel threatened and insecure. But its time to realize whats going on. At least so you can tell your children what storytelling the government used to destroy the spirit of the Internet. Just in case the history books goes with the public propaganda, and they probably will.
bdunbar 14y ago
why would anyone doing serious crime use Skype? I don't agree with this at all but ... I'd venture that most criminals are not exactly tech savvy. We've all seen those stories about guys caught because they posted pictures of their deeds on Facebook or Myspace.
- pdubs 14y ago
  >I'd venture that most criminals are not exactly tech savvy Even if this is currently true; it will change.
  - deleted 14y ago
    [deleted]
  - thematt 14y ago
    Will it? Criminals know they can be wiretapped, but that hasn't stopped them from using phones for communicating.

bgentry 14y ago

nextparadigms 14y ago
Indeed. That comes from the same FBI who said a couple of months ago that having to get warrants makes their job harder.
- lkrubner 14y ago
  Indeed. Having to respect any civil rights protections (the need for a warrant, habeas corpus, the right to silence, the right to avoid self-incrimination, the ban on torture, etc) makes life more difficulty for the authorities. But history shows that those societies that have no civil rights protections are not happy or prosperous over the long term, and a government that rids itself of all checks and balances is a government that must necessarily be authoritarian and unaccountable.
howeyc 14y ago
This is exactly what I don't understand every time they try to pass a law like this, it's always "It's getting harder for us to catch criminals doing X," where X changes depending how hard they think they have to force it. My response is always, NOBODY said law enforcement SHOULD BE EASY, deal with it.
- cnbeuiwx 14y ago
  You have to give them some credit though because its a clever scheme. The "fight crime" argument is always valid since crime always exists. Its the same with "fight terrorism" since terrorism always exists. So if you use those arguments, in combination with a war that has no end (you cant win against a "ism"), you dont even have to talk to the public anymore and justify anything. Its very convenient and saves time. Note the sarcasm. :)

rodly 14y ago

If this gets any traction we will at least benefit in 100% knowing our (American) government is a joke. The FBI has a "going dark" problem? Really!? How is that possible exactly? Criminals aren't using Facebook and Skype to discuss their activities. Even if they were, I'm sure Facebook and Skype have some automated flagging system for keywords that come up in any communication channel they operate. Nonetheless, aside from cyber criminals, "hackers", traditional criminal behavior is executed in real life. The same reality that the FBI has sufficient surveillance on 24/7.

drivingmenuts 14y ago
We might understand the joke, but we're only an insignificant part of the voting population. The vast majority of American voters don't understand that their ability to sleep at night free of terror comes at the chipping away of their freedoms elsewhere. They don't make the connection between feeling up someone else's kids in an airport and the loss of freedoms in general. The things we talk about (encryption, backdoors, etc.) seem trivial to us because we're buried in it every day or at least have some context to place it in. But Joe the Plumber or Betty the Housewife doesn't. They don't even really have a place to start to get simple, concise information on how to start understanding it in a way that fits in with their daily lives. It's not that they can't learn - they don't have the resources or the time.

forgottenpaswrd 14y ago

I do not use facebook, but... ...If they pass this law I am also quiting from gmail. We need a freedom box that we control and is distributed, not centralized so automation of surveillance is harder. I know that there are bad guys out there, but not only in terrorist organization, secret service use to have garbage people too (the people that love power too much).

ajross 14y ago
I don't think Google delivers over TLS (it doesn't to my server anyway), so in general your mail is subject to wiretapping anyway. And even if it did there's no way protocol I know (maybe DKIM has a section for destination verification?) for them to know that they're really delivering it to the right host. Basically unencrypted email is a lost cause already. If you care about this stuff you need to dump webmail right now and go with a client encryption solution (and convince all your friends to use it).
- sp332 14y ago
  Gmail is https by default.
  - ajross 14y ago
    That's between your browser and their server. I'm referring to the content of the SMTP connection over which the mail travels, which remains almost always unencrypted in the modern world. Which essentially means that the FBI doesn't need Google's assistance to wiretap your email per se, they just use and machine they probably have sitting on the backbone pipe anyway.
    - sp332 14y ago
      POP, IMAP, and SMTP access to Gmail servers all require TLS. https://support.google.com/mail/bin/answer.py?hl=en&answer=78799 https://support.google.com/mail/bin/answer.py?hl=en&answ... and https://support.google.com/mail/bin/answer.py?hl=en&answer=13287 https://support.google.com/mail/bin/answer.py?hl=en&answ... Edit: oh you mean from e.g. comcast.com server to mail.google.com server. Never mind.

agwa 14y ago

In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities It is not at all a given that this "going dark problem" actually exists. In many ways, surveillance is easier than it has ever been. See https://www.cdt.org/blogs/2811going-dark-versus-golden-age-surveillance https://www.cdt.org/blogs/2811going-dark-versus-golden-age-s...

abruzzi 14y ago

This would seem to be an opportunity for CS people to do what the do best--obfuscate through bad UI design. If they're legally obligated to provide an interface, then why make it a good interface? I'm thinking that the FBI's interface to the snooping back door should be through a pseudo-lisp interpreter with vividly named functions: (violateRights (shackle (humiliate userID))) Or similar.

moron 14y ago
Yeah, or maybe the backdoor "accidentally" has a lot of null-reference bugs and other crappiness. It isn't adding business value in the first place, why try to make it any good.
simonbrown 14y ago
Or a Malbolge API.
malandrew 14y ago
Alternatively, there is no reason such a backdoor can't be programmed to inform the user. "Usage of this backdoor will inform the user that they are being surveilled" I don't think you can execute a National Security Letter gag order against source code.
- corin_ 14y ago
  Obviously the fact that it's in source code is irrelevant, otherwise every gag order could be got round with a quick <p>here is the information</p> page hosted on a webserver.. It's like saying you can shoot somebody because a gun can't be prosecuted for murder.
  - malandrew 14y ago
    Yeah, but when someone gets shot with a gun you can't prosecute the manufacturer, so long as they put warning labels on their guns and sell them according to the laws regulating the sale of guns. The person responsible is the person who pulled the trigger, which in this case would be the Feds. The key is to make sure that they get access to the backdoor directly. At the end of the day you can always code loopholes around the law, which will work until they legislate the loopholes away with more legislation. Almost every industry has been doing this since the beginning of government. One of the best ways to code this into the system is to provide security measures that allow you to prevent what machines can access your account and notify you if machines not your own try to access your account. "You recently tried to access your account from the IP address X.X.X.X located in Quantico, Virginia. If this was not you, please report this to customer service." Customer service can then legitimately comply with the gag order by admitting nothing and say they'll look into it.

hhastings 14y ago

If al-Qaeda can build their own bombs and guns, I'm pretty damn sure they can set up their own secure Email & VOIP servers.

typicalrunt 14y ago
Screw email and VOIP servers. In the movie Traitor, one person would compose an email and then save it to the draft folder. Then the other person would login to the same Webmail account and read the draft message. Since the message is never sent over the wire, there's no need for secure email (only SSL for the email client).

gregPC 14y ago

This just proves the world is overpopulated when we have such useless idiots as the FBI, inventing new ways to make themselves seem useful. If you are an FBI agent, quit your job, buy a dairy cow, and finally give the world something it needs.

readme 14y ago

I hope someone stands up to these bullies. They can't make us do this. Really, a few powerful people just need to say no. If you are in this position, please for the love of god don't agree to put a surveillance backdoor in your website.

kozubik 14y ago
Done and done: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt We've been running it for seven years now: http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-canary-in-2010-and-beyond.html http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-can...
- cnbeuiwx 14y ago
  Very nice, but what if you get a gag order from FBI or NSA? Then you would be required to go to prison if you uphold your promises on the web site and disclose what happened. But I would be interested in your comments regarding this theoretical situation. Surely you must have thought about it.
  - kozubik 14y ago
    The gag order is the whole point. Read through it again - it is a positive, affirmative statement that we make each week (and make in three continents). A judge (or LEA, whatever) would have to compel us to make false public statements on an ongoing basis, and would have to further compel foreign (swiss) nationals to do likewise. Can we be held in contempt, etc., for refusing to make public false statements ? Perhaps. In reality, since rsync.net is not actually an ISP (we take pains to make sure we do not count as an ISP, since it allows us to skip things like the OP has posted) and since we host no publicly available materials, we're not likely to get a warrant. If we do, it's likely to be an extremely mundane act of discovery, etc. That would get added to the warrant canary and we would continue updating it. In our 11 years of running this service (7 years under the "rsync.net" brand) we've not gotten a single one. But the parent to these comments was speaking of taking a stand, which is why this was instituted - people do indeed need to make a stand. We refuse to live in a world with Lettres de Cachet, and that's that.

shareme 14y ago

here is my interface: if FBI wants to violate the constitution { here_is_your_hand_grenade make sure to pull pin before inputting your data request } else { hackers saved you thank us later }

theorique 14y ago

Do not fear, subjects. If you have done no wrong, you have nothing to worry about. Sleep safely in your beds. The government is watching over all who might do you harm.

spoiledtechie 14y ago

I don't know about anyone else here, but I am getting sick and tired of this. I personally think we as a community need to start a movement. This is ridiculous.

zupreme 14y ago

I just heard a BBC news spot where one of the interviewees, a law professor if I recall correctly, indicated that the support for CISPA by Facebook and other prominent startups was in order to provide legal cover for just these types of requests. Under current rules, it was stated, while these companies can be pressured by the FBI to release certain info and give certain access, they have no immunity from litigation - so they can still be sued for complying with the requests by their users and other concerned parties. The interviewee indicated that CISPA gives them the legal immunity they need so that they can comply with the FBI while being able to fend off potential lawsuits.

deleted 14y ago
[deleted]

nollidge 14y ago

"To serve and protect." Is that even true anymore? Was it ever? Was just reading about an apparent increase in cop-on-citizen sexual assault among Occupy Wall Street protesters: http://www.nakedcapitalism.com/2012/05/david-graeber-new-police-strategy-in-new-york-sexual-assault-against-peaceful-protestors.html http://www.nakedcapitalism.com/2012/05/david-graeber-new-pol... Why aren't our law enforcement professionals more accountable to us, the citizens they purportedly "serve"? The transaction ought to be that we, the citizenry, grant them privileges - go through red lights, carry firearms, right to detain people - in return for restraint and considered application of those privileges. I no longer believe in the integrity of that transaction. Maybe I'm overreacting to propaganda. But what reassurance does our law enforcement ever offer us that they are not abusing their privileges?

cnbeuiwx 14y ago
Why should they be accountable to you? The law enforcement gives them their salary, it protects them, it puts food on their table. What do ordinary citizens do for them, except create work for them to deal with? Edit: Just so you dont think I am nuts, I realize the insanity of the system, and I wish this was a world where intelligent, compassionate people made the decisions.
- WiseWeasel 14y ago
  Elect their boss?
  - cnbeuiwx 14y ago
    From a pool of candidates being presented to you as choices, preselected to be there because they are all corrupt? If you add a predetermined winner, you have your presidential election system. :)
    - WiseWeasel 14y ago
      I blame old centralized media. That's changing, if more slowly than some of us might like, and disturbingly quickly for others.

DanielBMarkham 14y ago

Some days I wish I could purchase a huge lighted sign, kilometers in length, and place it on the moon. It'd say "The internet is not broken" I think I'd make it flash. That's it. It's not perfect, security is a real threat and hassle to those on it, but it's not broken. It does not need fixing by the government. I am very sorry that the FBI is unable to track communications on the net. Really I am. But this is no different than the problem they had before telephones were invented. In fact, throughout much of our nation's history, law enforcement had no idea what kind of communications criminals had. The universe did not explode. Somehow life went on. I read last week that although most recent college grads are having problems finding work, there are exceptions. One of those are, sad to say, legal professionals seeking government work. The federal government is snatching up young lawyers and even paying off all their college bills in addition to their salary. In return we're creating an army of legal attack dogs in each agency looking for new ways to "fix" things for their paymasters. Once again, it's not perfect. But it does not need fixing. What we're seeing now isn't the end of some long civil discussion about what rights everybody should have in a technological world. It's the beginning -- just the beginning -- of a new world where a lot of things we took for granted just a decade ago aren't going to be true any more.

ArtB 14y ago
> I am very sorry that the FBI is unable to track communications on the net. Really I am. But this is no different than the problem they had before telephones were invented. In fact, throughout much of our nation's history, law enforcement had no idea what kind of communications criminals had. The universe did not explode. Somehow life went on. A gem, so I wanted to highlight it from the rest of your post.
- ahi 14y ago
  Pedantry: The telephone predates the FBI by about 30 years or so.
- btilly 14y ago
  It would be a gem, were it true. Generally criminals have had the same kinds of communication as the rest of us. Before the internet, the telephone. Before the telephone the telegraph. Throughout both and before, regular mail. The FBI and preceding law enforcement forces have demanded and found ways to tap these communication mechanisms. Some private networks escaped their surveillance - such as the Rothschild carrier pigeon network - but government surveillance of private individuals is not a new problem. What is relatively new is that the mechanisms that would be used to provide it are easily exploitable by a clever person sitting in a room in China. You can't easily give the FBI tools to catch local criminals without creating exploitable security threats in our own infrastructure.

cantankerous 14y ago

Ala Field of Dreams: if you tap it, they will encrypt. Encryption was much harder to obtain on phone-like devices for 'common-folk'. On data-oriented medium, it's pretty much par for the course. Not sure how this is so readily justifiable.

kaichanvong 14y ago

It would seem they are more obsessed dealing with the symptoms of the problem than the real problem.

jpdoctor 14y ago

The FBI needs to learn: Implementing surveillance techniques like these is the best business subsidy that foreign web sites could ever dream of. What a great way to drive email servers out of their reach. Someone needs to make the FBI more supportive to US businesses.

cookiecaper 14y ago

Use encryption on ALL data that you don't want to publicly readable. I post something that says this pretty much weekly on here and I'm sure I could post it every day if I had the time. Stop trusting third parties to keep your data back; they lose it all the time, through subpoenas, leaks, accidents, exploits, whatever. Take responsibility for yourself. If you have comms that can't safely be aired on CNN, ENCRYPT THEM. There's simply nothing else to say on the matter. Don't trust anyone else to protect you, because they aren't able to even if they try. You must use real, client-side cryptography to keep your message even semi-secure.

mvip 14y ago
While I most certainly agree, this begs the question: what encryption tools can you use (and trust)? I'm pretty confident that there are backdoors in most commercial tools from Apple, Microsoft and PGP (just to name a few). Before anyone is too quick on say that TrueCrypt is the answer, please note that there have been wild speculations about backdoors etc in TrueCrypt too (but I don't think anything has been proven).
- Karunamon 14y ago
  Truecrypt is OSS and has some insanely brilliant people working on it. I think that more than a couple people would notice if there were shenanigans afoot.
  - cnbeuiwx 14y ago
    Hmm. Interesting statement since the authors have chosen to remain anonymous. You would think it would be impossible to know weather or not they are brilliant, or if they are working for the US security agencies. So you have people working on the most well known full disk encryption system on planet Earth, but they are living in obscurity.... kind of interesting isnt it?
    - mvip 14y ago
      or they have chosen to stay anonymous to avoid being pressured by various governments to implement backdoors. I guess we will never know for sure.

Joss451 14y ago

Can't they just borrow it from the NSA?

novalis 14y ago

Let us all just stream, wait... triple stream everything to that new shiny spy center they built in Utah and just get over with it already. These people are simply out of control now. The fact that this is in the works just shows how unapologetic the clueless little three letters are these days. One step up from that is the analysis that these people intend to operate above the law and these "secret" understandings that they build on laws must be put to an end while the authors must be jailed for a long time.

WiseWeasel 14y ago

This is sure making offshore hosting/incorporation look pretty sweet right now. Facebook should move their headquarters to New Zealand.

albertsun 14y ago

The worst part is that laws like these add to the regulatory burden faced by small internet startups to get off the ground. The trickier the legal environment and the amount of rules that a company has to abide by to do business online, the harder it will be to do business and the fewer startups will succeed. The internet giants, Microsoft, Google, Facebook, et al. might even welcome additional rules like this. They provide additional barriers to entry and provide them more protection against new competitors. I'd reckon that it's in large part because the internet hasn't had many rules like this that the cycles of innovation online have been so fast.

simonbrown 14y ago
The article said there would be minimum number of users for the rules to apply.
- albertsun 14y ago
  The effect is still there, it makes scaling up more difficult. There are possible futures where very small teams can run services for very large numbers of people.

getpost 14y ago

I don't see how this could ever work, in practice. What constitutes a sufficient surveillance capability for a webapp that is constantly evolving? With every change to your app, you have to update the surveillance aspect as well. This seems like a real burden that limits innovation. > The requirements apply only if a threshold of a certain number of users is exceeded So, you start the next Instagram with barebones resources. You don't design/build surveillance into your admin console. Your service takes off, and then you have to stop accepting users after some magic number? The government needs to get over the idea that surveilling everyone in all circumstances is the best way to promote a civil society.

nirvana 14y ago

I wonder how they are going to enforce this law on cryptographically secure communication software written by some anonymous group and released as open source software out on the net? I guess being able to pin the maintainer of the github repository to the wall might be a problem, but its easy to imagine this just forcing development underground and users upgrading only in big jumps every couple of years. Its not like this software would need to be changing all the time... people could email each other their ip addresses or the software could take care of it for them in the background. (e.g.: when its running it polls your email server to see if you've gotten an email with your friends ip address being updated, signed by his private key, then if you want to call him your client has the right email address to send the packets to directly)... negating the need for any kind of centralized server. (I'm sure there are better ways to do this.) Write a javascript version that can run in the browser and anyone with a web browser can then use it (and you can sidestep the appstore as well, because you can make downloadable installable javascript apps that show up on the home screen in this way. Apple's had that in there since before the appstore and it still works and is supported.)

lurchpop 14y ago
They can just make it illegal to use that software, and use a gun silencer analogy. a 75 year old judge would eat that up.

lurkinggrue 14y ago

There's something that totally won't be hacked or leaked.

bretthardin 14y ago

I think the FBI is watching the movie, "The Net" too much.

tubbo 14y ago

"If you create a service, product, or app that allows a user to communicate, you get the privilege of adding that extra coding" What kind of sick, twisted monster thinks "adding extra coding" is a GOOD THING???

zmmmmm 14y ago

"only if a threshold of a certain number of users is exceeded" And thus the stupidity and evil-ness of the whole plan is revealed. They don't want to spy on criminals, who will use the minority methods that aren't monitored. They want to spy on the general population who is innocent of any crime.

SkyMarshal 14y ago

2012 is shaping up to be a deluge of rights-curtailing legislation. Did the guys behind the curtain just decide that smart-bombing Congress with this shit doesn't work, it gives citizens enough time and leeway to resist it, so instead they're gonna try the carpet-bombing strategy instead? WTF. We shouldn't have to keep fighting these battles.

twelvechairs 14y ago

When things like this happens it makes it seem sensible that China doesn't allow US companies (facebook et al) into their market. When it comes down to an argument of who gets to spy on users - theyd rather do it themselves than allow another country to do it behind the back door. (note: I'm not saying its right that anyone should) So whats the net result? Bad for business - bad for innovation, because you are further dividing the internet (and hence the market for internet services) up on nationalistic lines.

wyck 14y ago

This is convoluted at best, the internet is not the telephone. The more they push, there more technology that uses encryption/vps/offshore/offworld/alternative routes/etc will become easier for the average user and not just the command line jockey. So what will the FBI do when sites start registering in other countries, use hosting in other countries, use alternative non U.S. DNS, open source, and encryption? ps. This is already happening on the small scale , and the losers are the job market. As a Canadian I no longer register .com names nor do I host in the U.S., and I did so for 10 years.

compilerc 14y ago

"The FBI draft also contains provisions for requiring mobile phone customers to speak clearly and slowly."

chefsurfing 14y ago

The influence of RAND Corp on this legislation is instructive. CISPA is not the creation of Hollywood or even the FBI, it's coming from people building a technocratic military-industrial complex. Interesting background interview with RAND researcher here: http://www.corbettreport.com/episode-173-alex-abella-inside-the-rand-corporation/ http://www.corbettreport.com/episode-173-alex-abella-inside-...

charlieok 14y ago

Woah, I didn't know that Joe Biden was the sponsor of the exact bill that Phil Zimmerman referenced in his essay, “Why I Wrote PGP”. From the OP: “On the other hand, as a senator in the 1990s, Vice President Joe Biden introduced a bill at the FBI's behest that echoes the bureau's proposal today. Biden's bill said companies should "ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." (Biden's legislation spurred the public release of PGP, one of the first easy-to-use encryption utilities.)” The bill: S.266 Latest Title: Comprehensive Counter-Terrorism Act of 1991 Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced 1/24/1991) Cosponsors (3) From Zimmerman's essay: “Senate Bill 266, a 1991 omnibus anticrime bill, had an unsettling measure buried in it. If this non-binding resolution had become real law, it would have forced manufacturers of secure communications equipment to insert special "trap doors" in their products, so that the government could read anyone's encrypted messages. It reads, "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." It was this bill that led me to publish PGP electronically for free that year, shortly before the measure was defeated after vigorous protest by civil libertarians and industry groups.” http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html In that case, thank you Joe Biden? :)

lukeschlather 14y ago

In related news, the FBI has banned sales of regular paper, and requires that any paper be embedded with microtransmitters that the FBI can easily activate and read the contents of the paper, effectively closing the analog gap that prevents papertapping.